Teaching students to hack

Abstract

1Teaching "hacking" as a legitimate means of training students in how to protect a future employer's data assets has been introduced into courses with increasing frequency. The introduction of "red teaming" and attack-based exercises into information security courses presents a potential ethical problem. This paper explores the issues involved in designing an information security course with lab components that involve destructive actions.

Assurance Cases as a Didactic Tool for Information Security

“…Although ideal, however, this approach requires re-thinking entire curricula, demanding time, effort, faculty mobilization, and other resources. Thus, single courses, or workshop series are the prevailing approaches [13,14,18], as shown in a US survey [19].…”

Teaching students to hack

“…In recent years, however, the term has taken on a more negative definition and is used most typically to describe a person who accesses computers and information stored on computers without first obtaining permission. Logan and Clarkson (2005) support that definition in describing hacking as accessing a system that one is either not authorized to access or who accesses a system at a level beyond their authorization. "It includes the application of computer skills to find vulnerable systems, penetrate systems, and to remove evidence of access to a system" (Logan & Clarkson, 2005 p. 157).…”

“…At the university level, the idea behind hacking as a means of training is a method of teaching students how to protect the data assets of a future employer (Logan & Clarkson, 2005). A debate exists as to whether teaching a student how to hack so that he may, in turn, utilize that skill in order to strengthen the network security of an employer or other reasons that benefit the greater good outweighs the risk of potentially teaching students skills that will be used in a negative or illegal manner (Hartley, 2006).…”

“…By understanding how to hack, a student not only knows how a system might be breached but can identify the signs of a breach and can determine where in a system a hacker might attempt an attack. By possessing the same skills as the criminal a student can better protect a system (Logan & Clarkson, 2005). The key to effectively teaching students how to hack so that they may use these skills in their future profession is in teaching them the ethical and legal implications of their skill, and the ramifications of misusing their skill.…”